CVE-2007-5274

CVE-2007-5274 describes a security vulnerability in Sun Java Runtime Environment (JRE) affecting various versions when used with Firefox or Opera browsers. This flaw allows remote attackers to bypass the security model for JavaScript outbound connections through a DNS rebinding attack, leveraging the LiveConnect API. The attack involves a discrepancy where JavaScript download uses browser DNS resolution, while socket operations rely on separate JVM DNS resolution, potentially leading to unauthorized data access. The vulnerability has a CVSS score of 2.6 (AV:N/AC:H/Au:N/C:N/I:P/A:N), indicating a network-based attack with high complexity, requiring no authentication, and primarily impacting integrity with no confidentiality or availability impact. Its FAUCET Risk Score is 8/100, suggesting a low overall risk. There is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a lack of widespread attention or concern.